In the last 9 or 10 posts, I’ve covered high level architectural concepts like distributed computing and frameworks. It’s time to start looking at issues relating to physical code again.
Before getting into a lot of code, we need some way to ensure that we create high quality code. This is where static code analysis comes in. We’ve looked at it before on in a blog post. There I looked at the benefits of static code analysis, and gave a code example using a popular tool, PMD.
In that post, I also suggested a website that maintains huge lists of analysis tools for many commonly used languages. They currently list over 100 tools for Java alone! This is intimidating for anyone trying to decide what tool to use. In this post I’m going to shorten the list to give you a better idea about static code analysers.
Revision of Static and Dynamic Code Analysis
What are the differences between static and dynamic code analysis?
-
Static code analysis is a way for us to test our code without actually running it. This is a very efficient and thorough way to find any potential problems. Errors can be discovered long before they cause runtime errors. Finding and fixing errors during development is less expensive than fixing those errors after deployment to production servers.
-
Dynamic code analysis is a way to test code while it’s being run on a real (or virtual) processor. It’s effective in finding subtle errors, because it tests the code’s interaction with external databases and services. These errors will not be found by static code analysis. However, we have to remember that dynamic code analysis can only find errors in the specific section of the code that is being run, not the entire codebase.
We should do both dynamic and static code analysis to get the best results.
Five Popular Analysers
Let’s look at five popular Java static code analysis tools. These can be used to test code from a number of different perspectives.
- CheckStyle
- PMD
- FindBugs/SpotBugs
- JaCoCo
- SonarQube
Using a few of these tools in combination will give you a powerful way to find problems, and create better and cleaner code.
All of these tools can be integrated into your build system, whether it’s Ant, Maven, Gradle, Jenkins, or IDEs like Eclipse, NetBeans and IntelliJ IDEA.
CheckStyle
As software development teams grow, it becomes important to define and enforce coding standards and styles.
Checkstyle can automate the process of checking Java code for style violations. It makes sure that the code follows a specific coding standard. It is highly configurable and can support many different code style conventions. For example, you could use the Sun Code Conventions or Google Java Style depending on your project preferences.
Checkstyle uses a set of rules that delve deep into the code to identify common coding errors. It can find class and method design problems. It can check code layout and formatting issues. The list of standard checks is here.
PMD
PMD is a mature source code analyser that can detect common programming errors. These include unused variables and code, unnecessary object creation, empty catch blocks, hard coding of passwords and IP addresses, possible bugs, suboptimal coding, and so on. PMD has a repository of known anti-patterns and common mistakes. After analysis, PMD generates a report of the offending lines of code.
PMD supports about 14 languages including Java, JavaScript, PL/SQL, Salesforce Apex and VisualForce, XML, XSL, and Apache Velocity. PMD is highly configurable and the latest releases support Lombok annotations. It can also do cyclomatic complexity analysis.
PMD includes a configurable copy-and-paste detector tool called CPD. This can find duplicated code in over 20 different programming languages.
PMD currently supports nearly 300 rules. PMD rule sets are here. The best practice is to start with the obvious rule sets like unusedcode and basic, and work your way up from there.
FindBugs/SpotBugs
FindBugs analyses Java code and generates a report listing all the bugs that could make a program misbehave. Examples are infinite loops, unused variables, bad exception handling, unclosed streams, string comparisons, null checks, security, threading issues, etc.
CheckStyle and PMD use the Java source code; FindBugs looks at the compiled Java bytecodes instead.
There is an exhaustive list of bugs recognized by FindBugs here.
FindBugs has unfortunately been abandoned by its project lead, and has been replaced by SpotBugs. SpotBugs is a fork of FindBugs built with community support, carrying on from where FindBugs left off.
SpotBugs has over 400 different bug patterns. Like FindBugs, SpotBugs separates patterns into several categories: bad practice, correctness, malicious code vulnerabilities, multithreaded correctness, performance, security, and dodgy code. There are two additional categories, experimental and internationalization, that only have a few patterns each.
JaCoCo
JaCoCo is a code coverage reports generator for Java projects. Code coverage is a software metric used to measure how many lines of code are tested with any automated tests.
JaCoCo analyses the project unit tests and reports on how much of the codebase they cover. Code coverage reports can be generated in several formats like HTML, CSV and XML.
We can set code coverage rules in our build tools to specify a minimum code coverage for classes, modules or projects. If the thresholds aren’t met, then the software won’t be moved into production. This is essential for organizations that want to ensure that every line of production code has been tested.
JaCoCo can also calculate the McCabe cyclomatic complexity score for each method examined. This can help identify code that could be difficult to debug and maintain.
An alternative to JaCoCo is Cobertura. It is also used to identify which parts of your Java codebase are lacking test coverage. Cobertura is free and open source.
SonarQube
SonarQube is developed by SonarSource. They also develop SonarLint and SonarCloud.
The products cover all major programming languages. SonarQube covers 30 languages. SonarCloud covers 26 languages. SonarLint covers about 20 languages.
SonarQube builds on the ideas of PMD, FindBugs and CheckStyle. It provides a static code analysis tool dashboard with a number of reporting features that allow teams to track progress over time.
SonarQube advocates testing software applications on these seven points:
- Enforce coding standards.
- Identify and eliminate bugs.
- Properly document the solution.
- Eliminate copy-and-paste type code duplication.
- Reduce code complexity.
- Enforce complete code coverage.
- Enforce commonly accepted design strategies.
SonarQube has a free and open-source Community edition, as well as three commercial editions (Developer, Enterprise and Data Center). Downloads can be found here.
Conclusion
Every developer wants to create high-quality Java code, but tight deadlines sometimes cause quality to take a backseat. If we integrate static code analysers into our build and deploy process, we can be confident that accidental errors won't find their way into a production release.
What do you think about static code analysers? Which ones do you use, and how helpful have they been to your project? I'd love to hear your your comments.
Until then, stay safe and write good code!